mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (skills, part 4)

Part 4 of 5 of the skill list of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills); each entry links to a page with that skill's SKILL.md.

Skills (continued)

• implementing-zero-trust-with-hashicorp-boundary — Installs and configures HashiCorp Boundary as a default-deny, identity-aware proxy for infrastructure access, including controller/worker setup, Vault-backed credential brokering, session recording, and OIDC/LDAP auth across an org/project scope hierarchy. Use when replacing VPN or direct network access with just-in-time, credential-less Boundary sessions, or standing up Boundary controllers and workers.
• integrating-dast-with-owasp-zap-in-pipeline — Integrates OWASP ZAP (Zed Attack Proxy) into GitHub Actions and GitLab CI pipelines, covering baseline, full, and API scan configuration against running applications, ZAP finding interpretation, scan policy tuning, and DAST quality gates. Use when testing running web apps or REST/GraphQL APIs for XSS, SQLi, CSRF, and auth/authz flaws, or when SAST alone is insufficient and runtime DAST is required for compliance or release gating.
• integrating-sast-into-github-actions-pipeline — Integrates CodeQL and Semgrep SAST scanning into GitHub Actions, covering scans on pull requests/pushes, rule tuning to cut false positives, SARIF upload to GitHub Advanced Security, and merge-blocking quality gates for high-severity findings. Use when adding automated code vulnerability detection to CI, enforcing consistent SAST org-wide, or producing SOC 2/PCI DSS/NIST SSDF compliance evidence.
• intercepting-mobile-traffic-with-burpsuite — 'Intercepts and analyzes HTTP/HTTPS traffic from mobile applications
• investigating-insider-threat-indicators — 'Investigates insider threat indicators including data exfiltration attempts,
• investigating-phishing-email-incident — 'Investigates phishing email incidents from initial user report through
• investigating-ransomware-attack-artifacts — Forensically preserve memory and disk, collect ransom notes and encrypted file samples, and identify the ransomware variant using tools such as ID Ransomware, Volatility, and Chainsaw/Hayabusa to determine the initial access vector and recovery options. Use immediately after discovering ransomware encryption, when scoping the incident forensically, or when documenting evidence for law enforcement and insurance claims.
• managing-cloud-identity-with-okta — Implement Okta as a centralized cloud identity provider: configure SSO with AWS, Azure, and GCP, deploy phishing-resistant MFA with Okta FastPass, automate user provisioning/deprovisioning, and enforce adaptive access policies on device posture and risk signals. Use when standing up Okta SSO, rolling out FastPass MFA, automating identity lifecycle, or building risk-based conditional access for cloud environments.
• managing-intelligence-lifecycle — 'Manages the end-to-end cyber threat intelligence lifecycle from planning
• managing-third-party-vendor-risk — Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review SOC 2/ISO 27001 evidence, set contractual right-to-audit clauses, monitor vendors continuously, and offboard securely. Use when assessing a new vendor, standing up a vendor-risk program, tiering a portfolio, reviewing a SOC 2/CAIQ, or writing security terms into a contract.
• mapping-attack-paths-with-bloodhound-ce — Collect Active Directory data with SharpHound and Entra ID data with AzureHound, ingest into BloodHound Community Edition, and analyze on-prem, cloud, and hybrid attack paths using built-in queries and custom Cypher. Use during authorized red-team or penetration-test engagements to map privilege-escalation chains toward domain/tenant compromise.
• mapping-mitre-attack-techniques — 'Maps observed adversary behaviors, security alerts, and detection rules
• migrating-to-post-quantum-cryptography — Build a cryptographic inventory/CBOM with OpenSSL 3.5+, deploy hybrid post-quantum key exchange (X25519MLKEM768) on TLS/VPN/SSH endpoints, generate ML-KEM/ML-DSA keys and PQC/hybrid certificates, and prioritize migration by harvest-now-decrypt-later (HNDL) exposure per NIST SP 1800-38. Use when inventorying enterprise cryptography for quantum-readiness, enabling hybrid PQC key exchange, or issuing and verifying PQC/hybrid certificates.
• modeling-threats-with-opencti — Deploy OpenCTI (Filigran) via Docker Compose and use the pycti Python client to model threat actors, intrusion sets, campaigns, and indicators as a STIX 2.1 knowledge graph with relationships (uses, attributed-to, targets). Use when building a centralized threat-intel knowledge base, correlating IOCs from multiple feeds into one adversary graph, or producing STIX bundles for detection engineering.
• monitoring-darkweb-sources — 'Monitors dark web forums, marketplaces, paste sites, and ransomware
• monitoring-scada-modbus-traffic-anomalies — 'Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous
• moving-laterally-with-netexec — Use NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout thresholds, execute commands, and dump SAM/LSA/NTDS credentials across SMB, WinRM, LDAP, MSSQL, SSH, and other protocol modules. Use during authorized internal penetration tests to find lateral-movement paths after obtaining credentials or hashes, or to conduct controlled password spraying and post-exploitation on in-scope hosts.
• operating-havoc-c2 — Deploy a Havoc C2 team server with Yaotl malleable profiles, generate evasive Demon agents using indirect syscalls and sleep obfuscation, and run post-exploitation and pivoting operations. Use during authorized, rules-of-engagement-bound red-team engagements for adversary emulation requiring a full C2 lifecycle (server setup, evasive implant generation, tasking, and lateral pivoting).
• operating-sliver-c2 — Stand up a Sliver C2 server and mTLS listeners, generate cross-platform implants and beacons, and run post-exploitation, pivoting, and BOF/.NET tooling via the Armory for adversary emulation. Use during authorized, rules-of-engagement-bound red-team engagements that need a full open-source C2 lifecycle spanning server setup, implant generation, and post-exploitation tradecraft.
• operationalizing-misp-threat-feeds — Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.
• orchestrating-llm-attacks-with-pyrit — Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
• parsing-artifacts-with-eric-zimmerman-tools — Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
• performing-access-recertification-with-saviynt — Configure and execute access recertification campaigns in Saviynt Enterprise
• performing-access-review-and-certification — Designs and runs access review and certification campaigns-scoping,
• performing-active-directory-bloodhound-analysis — Use BloodHound and SharpHound (or AzureHound) to enumerate Active Directory
• performing-active-directory-compromise-investigation — Investigate Active Directory compromise by analyzing authentication logs,
• performing-active-directory-forest-trust-attack — Enumerate and audit Active Directory forest trust relationships using
• performing-active-directory-penetration-test — Conduct a focused Active Directory penetration test using BloodHound,
• performing-active-directory-vulnerability-assessment — Assess Active Directory security posture using PingCastle, BloodHound,
• performing-adversary-in-the-middle-phishing-detection — Detect and respond to Adversary-in-the-Middle (AiTM) phishing attacks
• performing-agentless-vulnerability-scanning — Configure and execute agentless vulnerability scanning using network
• performing-ai-driven-osint-correlation — Use AI/LLM-based reasoning with Sherlock, theHarvester, and SpiderFoot
• performing-alert-triage-with-elastic-siem — Perform systematic alert triage in Elastic Security SIEM—classifying,
• performing-android-app-static-analysis-with-mobsf — 'Performs automated static analysis of Android applications using Mobile
• performing-api-fuzzing-with-restler — 'Uses Microsoft RESTler to perform stateful REST API fuzzing: compiles
• performing-api-inventory-and-discovery — 'Performs API inventory and discovery to identify all API endpoints in
• performing-api-rate-limiting-bypass — 'Tests API rate limiting for bypass vulnerabilities using Python (requests/aiohttp)
• performing-api-security-testing-with-postman — 'Uses Postman to build structured API security test collections covering
• performing-arp-spoofing-attack-simulation — 'Simulates ARP spoofing/cache-poisoning attacks in authorized lab or
• performing-asset-criticality-scoring-for-vulns — Build a multi-factor asset criticality scoring model—incorporating data
• performing-authenticated-scan-with-openvas — Configure and execute authenticated (credentialed) vulnerability scans using OpenVAS/Greenbone
• performing-authenticated-vulnerability-scan — Plan and run authenticated (credentialed) vulnerability scans with scanners such as
• performing-automated-malware-analysis-with-cape — Deploy and operate the CAPEv2 malware sandbox (a Cuckoo derivative) to run samples in a
• performing-aws-account-enumeration-with-scout-suite — Run the agentless, open-source ScoutSuite tool (via pip install and the scout CLI)
• performing-aws-privilege-escalation-assessment — 'Performing authorized privilege escalation assessments in AWS environments
• performing-bandwidth-throttling-attack-simulation — 'Simulate bandwidth throttling and network degradation attacks using tc,
• performing-binary-exploitation-analysis — 'Analyze ELF binaries for memory-corruption vulnerabilities and build proof-of-concept
• performing-blind-ssrf-exploitation — Detect and exploit blind Server-Side Request Forgery (SSRF) using out-of-band
• performing-bluetooth-security-assessment — Assess Bluetooth Low Energy (BLE) device security using Python's bleak asyncio
• performing-brand-monitoring-for-impersonation — Monitor for brand impersonation attacks across domains, social media,
• performing-clickjacking-attack-test — Testing web applications for clickjacking vulnerabilities by assessing
• performing-cloud-asset-inventory-with-cartography — Run Cartography to sync AWS, GCP, or Azure resources into a Neo4j graph database,
• performing-cloud-forensics-investigation — Collect and analyze cloud forensic evidence using AWS CLI, Azure CLI, or gcloud
• performing-cloud-forensics-with-aws-cloudtrail — Investigate AWS account compromise by querying CloudTrail with boto3's LookupEvents
• performing-cloud-incident-containment-procedures — Execute cloud-native incident containment across AWS, Azure, and GCP using platform
• performing-cloud-log-forensics-with-athena — 'Uses AWS Athena to query CloudTrail, VPC Flow Logs, S3 access logs,
• performing-cloud-native-forensics-with-falco — 'Uses Falco YAML rules for runtime threat detection in containers and
• performing-cloud-native-threat-hunting-with-aws-detective — Investigate AWS security incidents using Amazon Detective's behavior graphs,
• performing-cloud-penetration-testing-with-pacu — 'Run authorized AWS penetration tests with Pacu, the open-source AWS exploitation
• performing-cloud-storage-forensic-acquisition — Perform forensic acquisition of cloud storage services including Google
• performing-container-escape-detection — Audits container and pod configuration for escape-enabling misconfiguration using the Kubernetes Python client - privileged flags, dangerous capability grants, host path mounts, shared namespaces, and CVE-2022-0492 style cgroup abuse. Use when sweeping a cluster for workloads that could break out, producing a posture report, or checking configuration before enforcement is switched on. Keywords: privileged, hostPath, hostPID, capabilities, CVE-2022-0492, cgroup, kubernetes python client, posture audit. Do not use for runtime syscall-based detection - use detecting-container-escape-attempts. '
• performing-container-image-hardening — 'Harden container images by minimizing attack surface, stripping unnecessary
• performing-container-security-scanning-with-trivy — Runs Trivy across every target type it supports - container images, filesystems, Git repositories, and Kubernetes clusters - for OS and dependency vulnerabilities, IaC misconfiguration, exposed secrets, and licences, generating CycloneDX or SPDX SBOMs. Use when integrating Trivy into CI/CD, deploying the Trivy Kubernetes operator, scanning non-image targets, or triaging results at scale. Keywords: Trivy, trivy k8s, operator, SBOM, CycloneDX, SPDX, misconfig, secret scanning. Do not use for a single Docker image scan - use scanning-docker-images-with-trivy.
• performing-content-security-policy-bypass — Analyze Content-Security-Policy headers and bypass them to achieve cross-site
• performing-credential-access-with-lazagne — Extract stored credentials from compromised endpoints using the LaZagne
• performing-cryptographic-audit-of-application — A cryptographic audit systematically reviews an application's use of
• performing-csrf-attack-simulation — Testing web applications for Cross-Site Request Forgery vulnerabilities
• performing-cve-prioritization-with-kev-catalog — Fetch and parse the CISA Known Exploited Vulnerabilities (KEV) catalog,
• performing-dark-web-monitoring-for-threats — Dark web monitoring involves systematically scanning Tor hidden services,
• performing-deception-technology-deployment — 'Deploys deception technology including honeypots, honeytokens, and decoy
• performing-directory-traversal-testing — Test web applications for path traversal and Local/Remote File Inclusion
• performing-disk-forensics-investigation — 'Conduct disk forensics investigations using forensic imaging, file system
• performing-dmarc-policy-enforcement-rollout — Execute a phased DMARC rollout by inventorying sending sources, configuring
• performing-dns-enumeration-and-zone-transfer — 'Enumerates DNS records, attempts zone transfers, brute-forces subdomains,
• performing-dns-tunneling-detection — 'Detects DNS tunneling by computing Shannon entropy of DNS query names,
• performing-docker-bench-security-assessment — Runs Docker Bench for Security, the open-source CIS Docker Benchmark audit script, across host configuration, daemon settings, images, and runtime configuration, then interprets pass/fail/warn output and remediates the common failures. Use when auditing Docker hosts for CIS compliance, scheduling recurring container assessments, or validating runtime hardening controls after a change. Keywords: docker-bench-security, CIS Docker Benchmark, audit script, pass fail warn, host configuration, remediation. Do not use for applying the daemon hardening itself - use hardening-docker-daemon-configuration.
• performing-dynamic-analysis-of-android-app — 'Performs runtime dynamic analysis of Android applications using Frida,
• performing-dynamic-analysis-with-any-run — 'Perform interactive dynamic malware analysis using the ANY.RUN cloud sandbox
• performing-endpoint-forensics-investigation — 'Performs digital forensics investigation on compromised endpoints including
• performing-endpoint-vulnerability-remediation — 'Performs vulnerability remediation on endpoints by prioritizing CVEs
• performing-entitlement-review-with-sailpoint-iiq — 'Runs entitlement review and access certification campaigns in SailPoint
• performing-external-network-penetration-test — Conduct a comprehensive external network penetration test to identify
• performing-false-positive-reduction-in-siem — Reduces SIEM false positives through systematic rule tuning, threshold
• performing-file-carving-with-foremost — Recovers files from disk images and unallocated space using Foremost's
• performing-firmware-extraction-with-binwalk — 'Performs firmware image extraction and analysis using binwalk to identify
• performing-firmware-malware-analysis — 'Analyzes firmware images for embedded malware, backdoors, and unauthorized
• performing-fuzzing-with-aflplusplus — 'Performs coverage-guided fuzzing of compiled binaries with AFL++, instrumenting
• performing-gcp-penetration-testing-with-gcpbucketbrute — Performs authorized GCP security testing using GCPBucketBrute to enumerate
• performing-gcp-security-assessment-with-forseti — 'Performing comprehensive security assessments of Google Cloud Platform
• performing-graphql-depth-limit-attack — Execute and test GraphQL depth limit attacks using deeply nested recursive
• performing-graphql-introspection-attack — 'Performs GraphQL introspection attacks that extract the full API schema
• performing-graphql-security-assessment — Assessing GraphQL API endpoints for introspection leaks, injection attacks,
• performing-hardware-security-module-integration — Integrates Hardware Security Modules (HSMs) via the PKCS#11 interface
• performing-hash-cracking-with-hashcat — Cracks password hashes with Hashcat, covering hash-type identification,
• performing-http-parameter-pollution-attack — Executes HTTP Parameter Pollution attacks that inject duplicate request
• performing-ics-asset-discovery-with-claroty — 'Performs ICS/OT asset discovery with Claroty xDome, combining passive
• performing-indicator-lifecycle-management — Tracks IOCs through discovery, enrichment/validation (VirusTotal, Shodan,
• performing-initial-access-with-evilginx3 — Perform authorized initial access using EvilGinx3 adversary-in-the-middle
• performing-insider-threat-investigation — 'Investigates insider threat incidents involving employees, contractors,
• performing-ioc-enrichment-automation — 'Automates Indicator of Compromise (IOC) enrichment by orchestrating
• performing-ios-app-security-assessment — 'Performs comprehensive iOS application security assessments using Frida
• performing-iot-security-assessment — 'Performs comprehensive security assessments of IoT devices and their
• performing-ip-reputation-analysis-with-shodan — Analyze IP address reputation using the Shodan API to identify open ports,
• performing-jwt-none-algorithm-attack — Execute and test the JWT none algorithm attack, crafting tokens with
• performing-kerberoasting-attack — Perform Kerberoasting, a post-exploitation technique that enumerates
• performing-kubernetes-cis-benchmark-with-kube-bench — Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled compliance audit, triaging kube-bench results, deciding which controls are not applicable on EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes Benchmark, control plane, remediation, compliance evidence, SOC 2, PCI DSS, managed cluster exception. Do not use for installing and running the tool - use benchmarking-kubernetes-with-kube-bench.
• performing-kubernetes-etcd-security-assessment — Assesses the security posture of the etcd cluster backing Kubernetes: encryption at rest, TLS peer and client transport, access control, backup encryption, and network isolation. Use when auditing or hardening a control plane, reviewing whether Secrets are encrypted at rest, or protecting etcd backups, since etcd stores Secrets, RBAC policy, and ConfigMaps in plaintext by default. Keywords: etcd, EncryptionConfiguration, encryption at rest, peer TLS, snapshot, backup, control plane. Do not use for broad cluster-wide CIS checks - use performing-kubernetes-cis-benchmark-with-kube-bench.
• performing-kubernetes-penetration-testing — Evaluates Kubernetes cluster security by actively simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policy, and secrets, using kube-hunter, Kubescape, peirates, and manual kubectl exploitation to find paths to cluster compromise. Use for an authorized penetration test or hands-on validation that controls actually stop an attacker. Keywords: kube-hunter, Kubescape, peirates, kubelet 10250, anonymous auth, token theft, lateral movement, cluster takeover. Do not use for a configuration-only compliance audit - use performing-kubernetes-cis-benchmark-with-kube-bench.
• performing-lateral-movement-detection — 'Detects lateral movement techniques including Pass-the-Hash, PsExec,
• performing-lateral-movement-with-wmiexec — Perform lateral movement across Windows networks using WMI-based remote
• performing-linux-log-forensics-investigation — Perform forensic investigation of Linux system logs including syslog,
• performing-log-analysis-for-forensic-investigation — Collect, parse, and correlate system, application, and security logs
• performing-log-source-onboarding-in-siem — Perform structured log source onboarding into SIEM platforms (Splunk,
• performing-malware-hash-enrichment-with-virustotal — Enrich malware file hashes (MD5, SHA-1, SHA-256) using the VirusTotal
• performing-malware-ioc-extraction — Malware IOC extraction is the process of analyzing malicious software
• performing-malware-persistence-investigation — Systematically investigate all persistence mechanisms on Windows and
• performing-malware-triage-with-yara — 'Performs rapid malware triage and classification using YARA rules that
• performing-memory-forensics-with-volatility3-plugins — Analyze memory dumps using Volatility3 plugins to detect injected code,
• performing-memory-forensics-with-volatility3 — Analyze volatile memory (RAM) dumps using the Volatility 3 framework
• performing-mobile-app-certificate-pinning-bypass — 'Bypasses SSL/TLS certificate pinning implementations in Android and
• performing-mobile-device-forensics-with-cellebrite — Acquire and analyze mobile device data using Cellebrite UFED Touch/4PC, UFED Physical Analyzer, and open-source alternatives (ALEAPP, iLEAPP, MEAT, libimobiledevice) to extract communications, call logs, location data, and application artifacts. Use when extracting or recovering deleted evidence from smartphones or tablets during criminal, corporate, or employee-misuse investigations.
• performing-network-forensics-with-wireshark — Capture and analyze network traffic using Wireshark and tshark to reconstruct network events from PCAP/PCAPNG files, extract transferred files and credentials, and identify command-and-control communications. Use when analyzing captured traffic from a security incident, reconstructing data exfiltration, or finding network indicators of compromise during malware analysis.
• performing-network-packet-capture-analysis — Perform forensic analysis of network packet captures (PCAP/PCAPNG) using Wireshark, tshark, and tcpdump to reconstruct network communications, extract transferred files, identify malicious traffic, and establish evidence of data exfiltration or command-and-control activity. Use when a PCAP file from an incident needs to be examined to prove lateral movement, malware delivery, or unauthorized access.
• performing-network-traffic-analysis-with-tshark — Automate network traffic analysis using tshark (Wireshark CLI) and pyshark to compute protocol distribution statistics, detect suspicious flows such as port scans and beaconing, extract IOCs (IPs, domains, URLs), and identify DNS tunneling patterns from PCAP files. Use when scripted or repeatable analysis of packet captures is needed rather than interactive inspection.
• performing-network-traffic-analysis-with-zeek — Deploy Zeek (formerly Bro) as a passive network security monitor to generate structured logs of protocol metadata (HTTP, DNS, TLS, SSH, SMTP, FTP, and more), write custom detection scripts, and integrate outputs with SIEM platforms. Use when standing up continuous, high-fidelity network traffic monitoring for threat detection, anomaly identification, or forensic investigation beyond what raw PCAP analysis provides.
• performing-nist-csf-maturity-assessment — Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap. Use when benchmarking an organization's cybersecurity program maturity or preparing a CSF-based gap analysis and remediation plan.
• performing-oauth-scope-minimization-review — 'Performs OAuth 2.0 scope minimization review to identify over-permissioned
• performing-oil-gas-cybersecurity-assessment — Conduct cybersecurity assessments of upstream, midstream, and downstream oil and gas operations, covering pipeline SCADA, refinery DCS, safety instrumented systems, and remote wellhead RTUs, and evaluate compliance with API 1164, TSA Pipeline Security Directives, and IEC 62443. Use when assessing a refinery, pipeline, or production facility or preparing for TSA/API compliance audits; not for IT-only or purely physical-security assessments.
• performing-open-source-intelligence-gathering — Open Source Intelligence (OSINT) gathering is the first active phase
• performing-osint-with-spiderfoot — Automate OSINT collection with the SpiderFoot REST API and CLI (sf.py/spiderfoot-cli) across 200+ modules, selecting scan modes (footprint, investigate, passive) and parsing results for domains, IPs, emails, leaked credentials, and DNS records into a target intelligence profile. Use when mapping an organization's attack surface or profiling a target for threat intelligence.
• performing-ot-network-security-assessment — 'This skill covers conducting comprehensive security assessments of Operational
• performing-ot-vulnerability-assessment-with-claroty — Perform OT vulnerability assessments using the Claroty xDome platform for asset discovery, risk scoring, and vulnerability correlation, combining passive traffic-based identification and active safe device querying with CVE/ICS-CERT advisory correlation for remediation prioritization. Use for scheduled IEC 62443 or NERC CIP OT vulnerability assessments, initial xDome deployment, or generating CIP-010-4 compliance evidence; not for active PLC scanning or penetration testing.
• performing-ot-vulnerability-scanning-safely — 'Perform vulnerability scanning in OT/ICS environments safely using passive
• performing-packet-injection-attack — 'Crafts and injects custom network packets using Scapy, hping3, and Nemesis
• performing-paste-site-monitoring-for-credentials — Monitor paste sites like Pastebin and GitHub Gists for leaked credentials,
• performing-phishing-simulation-with-gophish — Deploy and run authorized phishing awareness campaigns with GoPhish, covering admin panel setup, SMTP sending profiles, email template and landing page creation, target user groups, and campaign reporting to measure click and credential-submission rates. Use when planning or executing a phishing simulation for employee security-awareness testing or measuring susceptibility to social engineering.
• performing-physical-intrusion-assessment — Conduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization.
• performing-plc-firmware-security-analysis — 'This skill covers analyzing Programmable Logic Controller (PLC) firmware
• performing-post-quantum-cryptography-migration — 'Assesses organizational readiness for post-quantum cryptography migration
• performing-power-grid-cybersecurity-assessment — Conduct cybersecurity assessments of power grid infrastructure spanning generation, transmission substations, distribution, and EMS control centers, covering NERC CIP compliance verification, IEC 61850 (GOOSE/MMS) substation protocol analysis, and synchrophasor (PMU) network security against threats like Industroyer/CrashOverride. Use for periodic NERC CIP assessments, substation automation or EMS/SCADA security reviews, or regional entity compliance audits; not for non-BES systems or generic OT assessments without power grid specifics.
• performing-privacy-impact-assessment — 'Automates the Privacy Impact Assessment (PIA) workflow including data
• performing-privilege-escalation-assessment — 'Performs privilege escalation assessments on compromised Linux and Windows
• performing-privilege-escalation-on-linux — Guides manual enumeration and automated tooling to escalate from a low-privilege
• performing-privileged-account-access-review — Conducts systematic reviews of privileged accounts to validate access
• performing-privileged-account-discovery — Discovers and inventories privileged accounts across enterprise infrastructure,
• performing-purple-team-atomic-testing — 'Executes Atomic Red Team tests mapped to MITRE ATT&CK via Invoke-AtomicRedTeam
• performing-purple-team-exercise — 'Performs purple team exercises by coordinating red team adversary emulation
• performing-ransomware-response — 'Executes a structured ransomware incident response from detection through
• performing-ransomware-tabletop-exercise — 'Plans and facilitates tabletop exercises simulating ransomware incidents,
• performing-red-team-phishing-with-gophish — Automates GoPhish phishing simulation campaigns using the Python gophish
• performing-red-team-with-covenant — Conducts red team operations using the Covenant C2 framework for authorized
• performing-s7comm-protocol-security-analysis — 'Perform security analysis of Siemens S7comm and S7CommPlus protocols
• performing-sca-dependency-scanning-with-snyk — 'This skill covers implementing Software Composition Analysis (SCA) using
• performing-scada-hmi-security-assessment — 'Perform security assessments of SCADA Human-Machine Interface (HMI)
• performing-second-order-sql-injection — Detect and exploit second-order SQL injection vulnerabilities where malicious
• performing-security-headers-audit — Auditing HTTP security headers including CSP, HSTS, X-Frame-Options,
• performing-serverless-function-security-review — 'Performing security reviews of serverless functions across AWS Lambda,
• performing-service-account-audit — Audit service accounts across enterprise infrastructure to identify orphaned,
• performing-service-account-credential-rotation — Automates credential rotation for service accounts across Active Directory,
• performing-soap-web-service-security-testing — Performs security testing of SOAP web services by analyzing WSDL definitions
• performing-soc-tabletop-exercise — 'Performs tabletop exercises for SOC teams simulating security incidents
• performing-soc2-type2-audit-preparation — 'Automates SOC 2 Type II audit preparation including gap assessment against
• performing-sqlite-database-forensics — Performs forensic analysis of SQLite databases by examining B-tree page
• performing-ssl-certificate-lifecycle-management — Automates the full SSL/TLS certificate lifecycle, including generating
• performing-ssl-stripping-attack — Simulates SSL stripping / HTTPS downgrade attacks using sslstrip, Bettercap, and mitmproxy in authorized lab environments to test HSTS enforcement, certificate validation, and HTTPS upgrade mechanisms. Use when performing an authorized penetration test to validate HSTS preloading and TLS certificate handling, demonstrate downgrade-attack risk to stakeholders, or train SOC teams to detect SSL stripping indicators in network traffic.
• performing-ssl-tls-inspection-configuration — Configure SSL/TLS break-and-inspect on next-generation firewalls and forward proxies to decrypt, inspect, and re-encrypt HTTPS traffic for malware and exfiltration detection, including deploying trusted CA certificates, managing exemptions for certificate-pinned apps, and privacy compliance. Use when setting up or auditing TLS inspection on network security devices to close the encrypted-traffic blind spot.
• performing-ssl-tls-security-assessment — Assess SSL/TLS server configurations using the sslyze Python scanning library to evaluate supported protocol versions, cipher suite strength, certificate chain validation, HSTS enforcement, OCSP stapling, and known vulnerabilities such as Heartbleed and ROBOT. Use when conducting a security assessment of a server's TLS configuration or verifying remediation of cipher/certificate weaknesses.
• performing-ssrf-vulnerability-exploitation — Tests web application URL parameters for Server-Side Request Forgery by probing cloud metadata endpoints (AWS/GCP/Azure at 169.254.169.254), internal network services, and protocol handlers (file://, gopher://, dict://) using a Python script, including IP-encoding bypass and DNS rebinding checks. Use during authorized penetration testing to confirm SSRF in a URL-fetching parameter and generate a vulnerability report.
• performing-static-malware-analysis-with-pe-studio — Performs static analysis of Windows PE malware samples using PEStudio to examine file headers, imports, strings, and resources without executing the binary, identifying packing, anti-analysis tricks, and malicious imports. Use for pre-execution triage of a suspicious Windows executable before sandbox detonation.
• performing-steganography-detection — Detects and extracts hidden data embedded in images, audio, and other media files using steganalysis tools such as StegDetect, zsteg, stegsolve, binwalk, steghide, and OpenStego to uncover covert communication channels. Use when investigating suspected data hiding or exfiltration via media files, espionage/insider-threat cases, or anomalies in media file properties found during standard file analysis.
• performing-subdomain-enumeration-with-subfinder — Enumerate subdomains of target domains using ProjectDiscovery's Subfinder
• performing-supply-chain-attack-simulation — Simulates and detects software supply chain attacks: typosquatting detection via Levenshtein distance against popular PyPI package names, dependency confusion testing against private registries, SHA-256 package hash verification, and known-CVE scanning with pip-audit. Use when auditing a project's dependencies for malicious or confused packages, or when assessing package-registry supply-chain risk.
• performing-thick-client-application-penetration-test — Conduct a thick client application penetration test to identify insecure
• performing-threat-emulation-with-atomic-red-team — 'Executes Atomic Red Team tests for MITRE ATT&CK technique validation
• performing-threat-hunting-with-elastic-siem — 'Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL
• performing-threat-hunting-with-yara-rules — 'Use YARA pattern-matching rules to hunt for malware, suspicious files,
• performing-threat-intelligence-sharing-with-misp — Uses PyMISP (the official MISP REST API library) to create events with structured IOCs (IPs, domains, hashes, URLs), enrich them with MITRE ATT&CK tags and galaxy clusters, manage sharing groups and distribution levels, search existing intelligence, and export in STIX 2.1 format. Use when creating, enriching, or sharing threat intelligence events on a MISP instance, or integrating IOC feeds with other platforms.
• performing-threat-landscape-assessment-for-sector — Conducts a sector-specific threat landscape assessment (financial, healthcare, energy, government, etc.) by profiling targeting threat actors, mapping attack vectors and MITRE ATT&CK TTPs with the attackcti/pandas Python stack, and analyzing exploited CVEs and incident trends from ISAC and vendor reports. Use when producing CTI for risk management or board-level reporting on an industry's threat exposure.
• performing-threat-modeling-with-owasp-threat-dragon — Uses OWASP Threat Dragon (web or desktop) to build data flow diagrams, identify threats with STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies via its auto-generation rule engine, and produce PDF threat model reports. Use during secure design review of an application architecture to build a formal threat model and document mitigations for GRC compliance.
• performing-timeline-reconstruction-with-plaso — Builds comprehensive forensic super-timelines using Plaso (log2timeline and psort) to correlate events across file system metadata, event logs, browser history, and registry artifacts into a unified chronological view. Use during complex forensic investigations that need cross-source event correlation, or when standard log analysis is insufficient to establish the sequence of activities for reporting findings.
• performing-user-behavior-analytics — 'Performs User and Entity Behavior Analytics (UEBA) to detect anomalous
• performing-vlan-hopping-attack — Simulates VLAN hopping attacks using switch spoofing and 802.1Q double tagging techniques in authorized lab environments to test VLAN segmentation effectiveness and switch port security. Use during an authorized penetration test to validate trunk port hardening, confirm DTP is disabled on access ports, and demonstrate Layer 2 segmentation bypass risk to network teams.
• performing-vulnerability-scanning-with-nessus — 'Performs authenticated and unauthenticated vulnerability scanning using
• performing-web-application-firewall-bypass — Bypasses Web Application Firewall protections using encoding tricks,
• performing-web-application-penetration-test — 'Performs systematic security testing of web applications following the
• performing-web-application-scanning-with-nikto — Runs Nikto, an open-source web server and web application scanner,
• performing-web-application-vulnerability-triage — Triages web application vulnerability findings from DAST/SAST scanners
• performing-web-cache-deception-attack — Executes web cache deception attacks by exploiting path normalization
• performing-web-cache-poisoning-attack — Exploiting web cache mechanisms to serve malicious content to other users
• performing-wifi-password-cracking-with-aircrack — 'Captures WPA/WPA2 handshakes and performs offline password cracking
• performing-windows-artifact-analysis-with-eric-zimmerman-tools — Performs comprehensive Windows forensic artifact analysis using Eric
• performing-wireless-network-penetration-test — Execute a wireless network penetration test to assess WiFi security by
• performing-wireless-security-assessment-with-kismet — Conduct wireless network security assessments using Kismet to detect
• performing-yara-rule-development-for-detection — Develops precise YARA and YARA-X rules for malware detection by identifying
• post-exploiting-microsoft-graph-with-graphrunner — Runs GraphRunner, a PowerShell post-exploitation toolset built on
• prioritizing-vulnerabilities-with-cvss-scoring — The Common Vulnerability Scoring System (CVSS) is the industry standard
• processing-stix-taxii-feeds — 'Processes STIX 2.1 threat intelligence bundles delivered via TAXII 2.1
• profiling-threat-actor-groups — 'Develops comprehensive threat actor profiles for APT groups, criminal
• recovering-deleted-files-with-photorec — Recovers deleted files from disk images and storage media using PhotoRec's
• recovering-from-ransomware-attack — 'Executes structured ransomware incident recovery following NIST/CISA
• red-teaming-llms-with-garak — Runs NVIDIA garak probe suites (jailbreak, prompt injection, data
• relaying-ntlm-for-adcs-esc8 — Uses Impacket's ntlmrelayx.py with a coercion tool (PetitPotam, Coercer,
• remediating-s3-bucket-misconfiguration — 'Provides step-by-step procedures for remediating Amazon S3 bucket
• reverse-engineering-android-malware-with-jadx — 'Reverse engineers malicious Android APK files using the JADX decompiler
• reverse-engineering-dotnet-malware-with-dnspy — 'Reverse engineers .NET malware samples using the dnSpy decompiler and
• reverse-engineering-ios-app-with-frida — 'Reverse engineers iOS applications using Frida dynamic instrumentation
• reverse-engineering-malware-with-ghidra — 'Reverse engineers malware binaries using NSA''s Ghidra disassembler and
• reverse-engineering-ransomware-encryption-routine — Reverse engineer ransomware encryption routines to identify cryptographic
• reverse-engineering-rust-malware — Reverse engineers Rust-compiled malware using IDA Pro and Ghidra, covering
• scanning-container-images-with-grype — Scans container images, filesystems, and SBOMs for known CVEs with Anchore Grype, matching Syft-generated SBOM packages against NVD, GitHub Advisories, and OS-specific feeds with configurable severity thresholds and failure gates. Use when Grype or Syft is the chosen toolchain, when scanning an existing SBOM rather than an image, or when gating a build on severity. Keywords: Grype, Syft, SBOM, NVD, GitHub Advisory, --fail-on, severity threshold. Do not use when the toolchain is Trivy - use scanning-docker-images-with-trivy.
• scanning-containers-with-trivy-in-cicd — 'Integrates Aqua Security''s Trivy scanner into CI/CD pipelines to detect
• scanning-docker-images-with-trivy — Scans a Docker image with Trivy for vulnerabilities in OS packages and language dependencies, misconfiguration, exposed secrets, and licence violations, emitting SARIF, CycloneDX, or SPDX output. Use when scanning or gating a specific image, wiring an image scan into CI/CD, or checking an image during an incident investigation. Keywords: Trivy, image scan, --severity, --exit-code, SARIF, ignore file, .trivyignore. Do not use for cluster-wide scanning or non-image targets - use performing-container-security-scanning-with-trivy; when the toolchain is Grype use scanning-container-images-with-grype.
• scanning-iac-and-images-with-trivy — Scans container images, Infrastructure-as-Code (Terraform, CloudFormation,
• scanning-infrastructure-with-nessus — Tenable Nessus is the industry-leading vulnerability scanner used to
• scanning-kubernetes-manifests-with-kubesec — Scores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deployment, mapping each finding back to the securityContext change that fixes it. Use when gating manifests in CI, reviewing YAML or a rendered chart before it reaches a cluster, or explaining why a manifest scored negatively. Keywords: Kubesec, manifest score, securityContext, readOnlyRootFilesystem, runAsNonRoot, CI gate. Do not use for scanning built images for CVEs - use scanning-docker-images-with-trivy; for admission-time enforcement use implementing-opa-gatekeeper-for-policy-enforcement.
• scanning-network-with-nmap-advanced — 'Performs advanced network recon using Nmap''s Scripting Engine (NSE),
• securing-agentic-ai-tool-invocation — Implements defense-in-depth controls at an AI agent's tool-invocation

Continues in mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (skills, part 5).

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.